Fifteen attackers. Seven thousand three hundred wallets. One hundred and thirty million dollars in bitcoin, gone — not from a hacked exchange, not from a bridge exploit, but from Coldcard hardware wallets, the devices designed for the paranoid. The anchor dropped, but I was already airborne. The numbers are still climbing, and the story is not close to finished.
Every one of those attackers is running the same math race. They are not phishing seed phrases. They are not exploiting a glitch in a smart contract. They are brute-forcing private keys from a firmware that forgot how to count. Chaos is just a pattern waiting for a faster eye, and the pattern here is typed in plain sight: weak entropy, public keys, and a blockchain that never forgets.
The first thefts hit hours before Coinkite's public warning. That detail matters. It means the attackers were not reacting to the news. They were already on the hunt, and when the official disclosure dropped, it simply confirmed what they already knew: there is a pool of wallets with mathematically breakable locks, and anyone with a laptop can start working through the combinations.
A wallet built for paranoia
Coldcard is not a consumer gadget. It is the bitcoin purist's pick — a small, austere hardware wallet with no camera, no Bluetooth, no touchscreen, and, until now, a nearly religious following among self-custody users. Coinkite built its reputation on giving up the bells and whistles in exchange for security. That is what makes this collapse so damaging. A wallet built to keep bitcoin offline just leaked $130 million worth of keys because of a weakness inside the device itself.
According to Galaxy Research, and reported by Protos, the affected wallets span the Mk2, Mk3, and Mk4 lines. The attackers, now at fifteen and counting, are draining vulnerable wallets in an automated way. Galaxy has received 73 victim reports, but the researchers do not believe that is the full picture. The number may be in the thousands. Many bitcoiners do not check their storage addresses daily. Some do not check annually. The exposed inventory is probably much larger than the reported casualties.
This is not a theoretical vulnerability. It is a live exploit. The vulnerability is still active in the wild, Coinkite has warned that the threat remains active, and the official advice is still an urgent move your funds. In a bull market, where FOMO is stronger than fear, that message is the least comfortable thing you can read.
Root cause: the PRNG that should never have touched a seed
Let's get to the root cause. When a Coldcard initializes a new wallet, the firmware is responsible for generating the seed phrase. That seed phrase, in turn, produces the private keys. If the randomness behind that seed is weak, the entire wallet is a math problem waiting to be solved. Galaxy's data points to a firmware path that fell back to MicroPython's software pseudo-random number generator. No hardware true random number generator. No secure element backing up the critical step. Just a software PRNG that was never designed to stand up to a determined attacker.
The numbers are brutal. Coldcard Mk2 and Mk3 devices have roughly 40 bits of entropy in the affected seeds. The Mk4 is better, but not by enough: around 72 bits. The industry target is 128 bits. That is not a minor shortfall. 40 bits is a factor of 2^88 smaller than 128 bits. Roughly speaking, a 40-bit keyspace can be searched by a determined attacker on ordinary hardware. A 72-bit keyspace is harder, but still far below what a well-funded threat actor can afford to scan for. The difference between 72 and 128 bits is not a speed limit — it is a universe.
A lock with 40 bits of key space is not a lock. It is a password hint.
Attackers do not need to physically access the cards. They do not need those little seed cards. The Bitcoin blockchain is public, and public keys are visible for many addresses — including addresses that have already spent from them, and in some cases even addresses that have only received funds, depending on the address type. The attacker takes the weak private key candidates, derives the corresponding public addresses, and scans the chain for matches. When a match appears, the funds are swept in seconds.
This is not sophisticated cryptography. It is a fishing expedition with a net that actually works. The first wave of thefts happened before Coinkite's announcement, which means that at least some attackers had already identified the vulnerable pool on their own. That is the same pattern I have seen in smart contract exploits: the attackers are faster than the press releases. Speed is the only asset that doesn't lie, and it is telling you the market is not safe.
The hotfix cannot fix the seed
Coinkite has pushed a hotfix across all affected models and release channels. Good. But read the official warning carefully: updating firmware cannot fix seeds generated under vulnerable firmware. Those seed phrases were born weak, and they will remain weak regardless of the patch. The only remedy is to generate a new wallet on known-good hardware and move every satoshi out of the old one. This is not a bug fix. It is a salvage operation.
Let me say that in blunt trader terms. The hotfix is like locking the barn door after the horses are already counted, branded, and loaded into the trailer. The seed cannot be scrubbed. The entropy is baked into every private key derived from that seed. If you keep bitcoin in a wallet generated under affected firmware, your security posture is no longer “self-custody.” It is “waiting for someone else's brute-force script to find you.”
Updating your firmware cannot cleanse a poisoned seed. That is not a patch; it is a death certificate for the affected wallet.
I have spent the past nine years in the uncomfortable zone between finance and code. I have audited smart contracts, watched reentrancy attacks eat protocols, and built trading systems that react faster than any human can. In all that time, the projects that scared me most were the ones that could not explain their randomness. Randomness is not a nice-to-have. It is the atomic unit of private key security. If a vendor cannot prove where the entropy comes from, it does not matter how beautiful the hardware case is.
In August 2021, I ran a flash loan arbitrage that earned $12,000 in under three minutes. The trade worked because I saw a timing delay in a new liquidity pool's pricing oracle. I did not trust the docs; I trusted the code. That lesson applies here. The docs would have told you Coldcard was safe. The code, if you looked at it, would have told you it was using a software PRNG in at least one path. Every flash loan is a mirror reflecting greed, but every weak seed is a mirror reflecting vendor complacency.
The hidden design failure
There is a deeper problem under the surface. The fallback to MicroPython's PRNG suggests that the hardware's true random number source was either not properly integrated, not reachable in certain code paths, or bypassed in the name of convenience. That is not just a bug. It is a design process failure. It tells me the firmware was not tested against the question that actually matters: what happens if the hardware entropy source fails? In a security product, the answer should be “stop and refuse to generate a seed.” Not “fall back to software randomness and hope nobody notices.”
A secure element is not a sticker on the box. It is a promise. When the promise breaks, the customer's assets do not just evaporate — they transfer to someone who understood the fragility better than the vendor did.
This is also the part that should worry owners of other hardware wallets. Most devices are black boxes. A vendor can claim “TRNG inside,” but unless there is a fully audited code path from entropy source to seed generation, the claim is mostly marketing. Coldcard, ironically, was better positioned than most because it controls its own firmware. That makes the failure more damning. If this can happen in a product built for paranoid bitcoiners, it can happen anywhere.
The market read: narrative damage is worse than the P&L
Let's talk like a trader for a second. $130 million is small relative to bitcoin's daily volume. It is not a macro signal. It is not going to trigger a cascade of liquidation. But it is a massive signal for the self-custody narrative. Flows are about to move: users who trusted Coldcard will either rotate to a competitor, or rotate back to exchanges. Exchange net inflows will be a quiet tell. In a bull market, people do not sell because of security news — they simply migrate the storage layer. The coins do not leave bitcoin; they just move to weaker hands.
The attack economy matters too. Fifteen attackers and climbing. That is a decentralized ransomware campaign without the ransomware. Each attacker is building their own scanning stack, using the same public ledger as a target list. The barrier to entry is low enough that script kiddies can participate. The minimum viable attacker is not a state actor. It is a kid with a GPU and a copy of the open-source address derivation code. That is the thing people miss: this is not a targeted heist, it is a mass casualty event with a low barrier to entry.
And look at the behavior of the stolen funds. Around 90% of the drained bitcoin has not moved yet. That does not mean the attackers are kind. It means they are patient. They are waiting for better market depth, better privacy tools, or a moment when the attention fades. That 90% is overhang. It is not pressing on the order book today, but it will be watching liquidity in the weeks ahead.
The first victim to report loses the wrong race. The last victim to move funds loses the actual bitcoin.
Contrarian: do not buy the “other wallet” narrative
The contrarian take: do not believe for a second that this is only a Coldcard problem. Every hardware wallet is a black box unless it has published a fully audited code path from entropy source to seed generation. The rest of the industry is going to run marketing campaigns selling you “secure element certified.” That is fine, but ask for the evidence. Ask for the audit report. Ask what the firmware does if the entropy source stalls. If they look confused, that is your answer.
The market may also draw the wrong conclusion: “Coldcard failed, so use an exchange.” That is the same lazy thinking that leads to centralized risk. The answer is not to abandon self-custody. The answer is to demand better self-custody tools. A hardware wallet is only as secure as its weakest supply chain decision. Coldcard's supply chain decision was to let a software PRNG touch a seed that would hold real bitcoin. That decision was made by a human, not by the device. The next attack will not look like this one, but it will start with the same hidden assumption: the vendor knows exactly what the hardware is doing. Usually, they do not.
What to do right now
If you are holding bitcoin in a Coldcard created during the affected period, think in price levels, not emotional levels. The immediate risk is not a 10% crash. The immediate risk is your specific address being found by a brute-force script. The probability is not zero. Move the funds. Generate a new wallet on verified hardware or, if that is not immediately possible, move the bitcoin to a well-vetted software wallet with strong entropy and verified origin. Do not wait for a second official announcement. The second announcement will not come with better news.
Track the stolen coins. When they start moving, you will see cluster activity on-chain. Watch the marked addresses. In a world where every transaction is public, the attackers leave footprints even when they wear masks. Law enforcement is already investigating across multiple jurisdictions. Victims are being told to report losses to local and federal authorities. That is the right move. But the chain is faster than the courthouse. The practical defense is not a subpoena; it is a new wallet.
Security is not a logo. It is a chain of evidence, from silicon to seed phrase. The Coldcard collapse is the latest reminder that in crypto, trust is a technical liability, not a social contract. The next question is not “which wallet should I buy?” It is “can the vendor prove where your randomness comes from?”
Speed is the only asset that does not wait for consensus. The attackers know it. The market is learning it. The question is whether the rest of the industry can learn it before the next firmware ships.
I am not waiting for an apology. I am waiting for an audit trail.
